Today, 2010-06-29, Adobe is planning to release an update
for Adobe Reader of version v9.3.2 and Adobe Acrobat of
version 9.3.2 (new version for both products is v9.3.3),
to address multiple security issues allowing code execution,
whose description is detailed in the Adobe Security Bulletin
APSB10-15:
[1] http://www.adobe.com/support/security/bulletins/apsb10-15.html
* This update resolves a memory corruption vulnerability that could
lead to code execution (CVE-2010-1297). Note: There are reports that
this issue is being actively exploited in the wild.
Red Hat is tracking this memory corruption vulnerability via a
dedicated Red Hat Bugzilla entry, which is reachable at:
[2] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-1297
* This update mitigates a social engineering attack that could lead to
code execution (CVE-2010-1240).
* This update resolves an invalid pointer vulnerability that could lead
to code execution (CVE-2010-1285).
* This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-1295).
* This update resolves an invalid pointer vulnerability that could lead
to code execution (CVE-2010-2168).
* This update resolves an invalid pointer vulnerability that could lead
to code execution (CVE-2010-2201).
* This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-2202).
* This update resolves a UNIX-only memory corruption vulnerability that
could lead to code execution (CVE-2010-2203).
* This update resolves a denial of service vulnerability; arbitrary code
execution has not been demonstrated, but may be possible (CVE-2010-2204).
* This update resolves an uninitialized memory vulnerability that could
lead to code execution (CVE-2010-2205).
* This update resolves an array-indexing error vulnerability that could
lead to code execution (CVE-2010-2206).
* This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-2207).
* This update resolves a dereference deleted heap object vulnerability
that could lead to code execution (CVE-2010-2208).
* This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-2209).
* This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-2210).
* This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-2211).
* This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-2212).